[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 06/13] kvmvapic: Catch invalid ROM size
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 06/13] kvmvapic: Catch invalid ROM size |
Date: |
Fri, 20 Sep 2013 18:24:45 +0200 |
From: Jan Kiszka <address@hidden>
If not caught early, a zero-length ROM will cause a NULL-pointer access
later on in patch_hypercalls when allocating a zero-length ROM copy and
trying to read from it.
CC: address@hidden
Signed-off-by: Jan Kiszka <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/i386/kvmvapic.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index d3a6fbe..c66fbf2 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -578,7 +578,7 @@ static int patch_hypercalls(VAPICROMState *s)
* enable write access to the option ROM so that variables can be updated by
* the guest.
*/
-static void vapic_map_rom_writable(VAPICROMState *s)
+static int vapic_map_rom_writable(VAPICROMState *s)
{
hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK;
MemoryRegionSection section;
@@ -599,6 +599,9 @@ static void vapic_map_rom_writable(VAPICROMState *s)
/* read ROM size from RAM region */
ram = memory_region_get_ram_ptr(section.mr);
rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
+ if (rom_size == 0) {
+ return -1;
+ }
s->rom_size = rom_size;
/* We need to round to avoid creating subpages
@@ -612,11 +615,15 @@ static void vapic_map_rom_writable(VAPICROMState *s)
memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);
s->rom_mapped_writable = true;
memory_region_unref(section.mr);
+
+ return 0;
}
static int vapic_prepare(VAPICROMState *s)
{
- vapic_map_rom_writable(s);
+ if (vapic_map_rom_writable(s) < 0) {
+ return -1;
+ }
if (patch_hypercalls(s) < 0) {
return -1;
--
1.8.3.1
- [Qemu-devel] [PULL 00/13] KVM patches for 2013-09-20, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 02/13] cpu: Move cpu state syncs up into cpu_dump_state(), Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 01/13] exec: always use MADV_DONTFORK, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 06/13] kvmvapic: Catch invalid ROM size,
Paolo Bonzini <=
- [Qemu-devel] [PULL 07/13] kvmvapic: Enter inactive state on hardware reset, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 05/13] kvm irqfd: support direct msimessage to irq translation, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 03/13] kvm: warn if num cpus is greater than num recommended, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 04/13] fix steal time MSR vmsd callback to proper opaque type, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 08/13] kvmvapic: Clear also physical ROM address when entering INACTIVE state, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 09/13] kvm: fix traces to use %x instead of %d, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 10/13] linux-headers: update to 3.11, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 11/13] target-i386: forward CPUID cache leaves when -cpu host is used, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 13/13] target-i386: add feature kvm_pv_unhalt, Paolo Bonzini, 2013/09/20
- [Qemu-devel] [PULL 12/13] linux-headers: update to 3.12-rc1, Paolo Bonzini, 2013/09/20